By Hamza Faisal

Zyxel has disclosed a second zero-day vulnerability in its GS1900 series network switches, admitting that the security patch it shipped in June never actually stopped the attacks. Hackers had already used the flaw to compromise nearly 1,000 switches across 48 countries, stealing device configurations and hashed administrator credentials.

The flaw, tracked as CVE-2026-107441, is an out-of-bounds write in the web management interface of the switches. An attacker needs no login at all: a crafted HTTP request to the management page can execute operating system commands as root, giving full control of a device that sits at the centre of a network.

Zyxel published its advisory on November 3, after releasing fixed firmware on October 22. The flaw affects ten GS1900 models running firmware 2.90(…).2 or earlier. Only the new Patch 3 firmware, version 2.90(…).3, closes the hole.

The patch that fixed the wrong bug

The story began in June, when Zyxel shipped firmware updates for a buffer overflow flaw known as CVE-2026-7273. At the time, that flaw was blamed for a wave of switch compromises, and in September CISA added it to its Known Exploited Vulnerabilities catalogue.

But researchers at Binarly suspected the diagnosis was wrong. On September 28 they tested all ten firmware releases sold as fixes for the June flaw — and found every one of them still exploitable. The circulating attack code had been updated to work on patched devices, which meant the real vulnerability was something else entirely.

Binarly reported the finding to Zyxel on September 29. The problem was in how the management interface copied HTTP request parameters into memory: it failed to validate their lengths before copying, allowing an oversized parameter to corrupt memory and redirect the program. Zyxel classified the missing validation as a separate vulnerability, reserving CVE-2026-107441 on October 11.

Zyxel rates the flaw 8.8 out of 10 on the CVSS severity scale. Binarly, which scores it as remotely reachable rather than LAN-only, rates it 9.8 — the highest possible band.

Nearly 1,000 switches hit in 48 countries

Threat researchers at GreyNoise tracked the campaign from around August 17, attributing it to a Chinese-speaking actor tracked as Kapibala and linked to the wider Red Heron campaign. In total, 996 GS1900 switches were compromised across 48 countries, with Italy, the United States and Taiwan hit hardest.

The attackers downloaded a data-collection script that gathered switch configurations, hashed root passwords and network details. GreyNoise also found that 564 of the compromised switches were still running factory-default credentials — meaning that in many cases, even without the zero-day, a reachable management page with the default password would have been enough.

The campaign's tooling was tied to infrastructure hosting the JITTERLY backdoor and its SIXZUT rootkit, previously linked to exploitation of Gitea servers.

What administrators should do now

Organisations running GS1900 switches should install the model-specific Patch 3 firmware immediately. Any device still on a .2 build or earlier remains vulnerable, including devices that received the June update for the earlier flaw.

Zyxel also advises taking the switch web interface off the internet entirely, managing devices from the local network or a VPN only. Any exposed switch should have its credentials rotated, since hashed root passwords were stolen in the campaign, and default passwords must be changed.

As of November 5, CISA had not yet added CVE-2026-107441 to its Known Exploited Vulnerabilities list, even though the exploitation is well documented. For anyone who patched in June and moved on, the message is blunt: the June fix closed one door, and the attackers were already using another.